By default, GateIn Portal allows to define security by Portlet.

Inside a portlet you need to invoke to Organization API to check wich user / role / membership you have and add your authorization logic inside your logic.

For example:

OrganizationService os = (OrganizationService)PortalContainer

                .getInstance()

                .getComponentInstanceOfType(OrganizationService.class);

        try {

            Collection groups = os.getGroupHandler().findGroupsOfUser(user);

            for (Object o : groups) {

                Group g = (Group)o;

                    if (g.getId().equals("mygroup")) {

                        try {

                            Membership m = os.getMembershipHandler().findMembershipByUserGroupAndType(user, g.getId(), "mymembership");

                            // Do something

                        } catch (Exception e) {

                            log.warning("Error querying user");

                            e.printStackTrace();

                        }

                    }

                }

Hope this helps.

Mmm I don't see a easy way to do it out-of-the-box, I'm not expert in security, but the Portlet 2.0 spec is limited about it.

I think that you can handle your logic internally, or in other case, to build your own custom web filter in top of portal application to handle XACML/Authz tokens and authorization logic.

Regards,

Lucas